Rapid Access Cloud: Se1ng up a Proxy Host

Transcription

1 Rapid Access Cloud: Se1ng up a Proxy Host Rapid Access Cloud: Se1ng up a Proxy Host Prerequisites Set up security groups The Proxy Security Group The Internal Security Group Launch your internal instances Launch and set up the proxy host instance Set up SSH access to your internal instances 1. Using IP- tables 2. Using ssh- agent Set up port forwarding to a web server All instances launched in the Rapid Access Cloud are connected to an internal IPv4 network that is private to the cloud. Instances have access to the internet through a gateway but are not directly accessible from the internet through IPv4. In order for an instance to be accessible from the internet over IPv4, it will either need to have a FloaOng IP assigned to it, or it will need to have traffic proxied to it via a proxy host. Due to the limited number of IPv4 addresses available on the internet, we encourage Rapid Access Cloud users to use IPv6 or create a proxy host. This document will describe the process of se1ng up a proxy host in the Rapid Access Cloud. It is structured as a tutorial and will walk you through the process of se1ng up a proxy host and 3 internal servers which we will forward traffic to. We will enable access to the 3 internal servers via SSH using 2 different methods, and we will forward traffic to an apache web server running on one of the servers (see figure below). Prerequisites We assume that you have some basic experience with the Rapid Access Cloud and that you have successfully launched an instance and connected to it remotely. Your account should already have one FloaOng IP assigned to it and it should be available for use with your proxy host. You should also have created an SSH key pair set and know how to use it.

2 Set up security groups For this tutorial we will use 2 separate security groups. One of these groups will be assigned to our proxy host and the other will be assigned to all of our internal hosts. The Proxy Security Group 1. Navigate to Access & Security and the Security Groups tab and create a new security group called Proxy. 2. Edit the Proxy security group and add the following rules to allow connecoons to your proxy host from the internet. Range Start: 22 Range End: 22 Range Start: 2201 Range End: 2203 Range Start: 80 Range End: 80

3 The Internal Security Group 1. Navigate to Access & Security and the Security Groups tab and create a new security group called Internal. 2. Edit the Internal security group and add the following rules to allow connecoons to your internal hosts. Range Start: 22 Range End: 22 Range Start: 80 Range End: 80 Note that the only real difference between the two groups is that ports 2201 to 2203 are configured on the Proxy security group. Launch your internal instances 1. Navigate to the Instances page and launch 3 instances named Internal- 01, Internal- 02, Internal- 03 with the following parameters: Image: Ubuntu KeyPair: select an appropriate key pair Security Groups: Internal security group Size: m1.ony Launch and set up the proxy host instance 1. Navigate to the Instances page and launch an instance with the following parameters (note the different image being used): Image: RAC Proxy Name: ProxyHost KeyPair: select an appropriate key pair Security Groups: Proxy Size: m1.ony RAC Proxy is a Ubuntu based image we ve created to be used for just this purpose and to save you Ome

4 installing the various components. 2. Once the proxy host instance is running assign your floaong IP address to the instance and confirm that you can connect to it via ssh. Set up SSH access to your internal instances There are 2 methods for gaining ssh access to your internal instances. 1. Using IP- tables This configures your setup to allow accessing your internal instances via SSH and involves forwarding ports on your proxy host to the ssh port on your internal instances. On your proxy host instance we will set up the following port forward rules Proxy Host port > forwards to Internal- 01 port 22 Proxy Host port > forwards to Internal- 02 port 22 Proxy Host port > forwards to Internal- 03 port 22 Each of these forwards requires 1 iptables rule to be added on the proxy host instance. We will configure the proxy host to add the iptable rules using a customized script. This ensures that your rules will be preserved should you reboot your proxy host or if you want to capture it with a snapshot and set it up again at a later point. As the root user, in /etc, edit the rac- iptables.sh script. Underneath the Add your rules below line, insert your rules as follows: iptables -t nat -A PREROUTING -p tcp --dport j DNAT --todestination <private IP of instance-01>:22 iptables -t nat -A PREROUTING -p tcp --dport j DNAT --todestination <private IP of instance-02>:22 iptables -t nat -A PREROUTING -p tcp --dport j DNAT --todestination <private IP of instance-03>:22 Make sure you change the field <private IP of instance- XX> in each line to contain the appropriate private IPs. You can find the private IPs in the Instance field of the Horizon dashboard. Aler you make these changes, you have to source the rac- iptables.sh script:./rac-iptables.sh Now you can ssh directly to each of your internal instances by specifying the appropriate port number.

5 For example, to reach Instance- 01 you would do the following. # ssh ubuntu@<floating ip of proxy host> -p i <your key> Note that you can expand these rules as you wish, but remember that you will have to add addioonal entries to your security groups if you want to uolize any ports beyond (See Set up Security Groups above) 2. Using ssh- agent SSH to your proxy host instance, and from there you can ssh to the internal IP address of your internal instances. In order to accomplish this, your proxy host instance will need to have access to your SSH private key so that it can authenocate to your internal instance. One easy way to make this happen is through the use of ssh- agent. If you are using SSH on the command line on your local mac or linux box, run the following 2 commands to start ssh- agent and to add your private key to it. If you are using a GUI SSH client (on windows for example) refer to your SSH client documentaoon to set up ssh- agent. # ssh-agent # ssh-add <path to your private key> Now, when you SSH to your proxy host you should use the - A flag to enable forwarding of the ssh- agent connecoon. # ssh -A ubuntu@<your floating ip address> And from your proxy host you can now ssh to your internal instances # ssh ubuntu@<ip address of internal instance> Set up port forwarding to a web server On Internal- 01 install the apache web server with the following commands # sudo apt-get update # sudo apt-get install -y apache2 On your proxy host execute the following command to add a port forward entry that forwards connecoons to port 80 of the proxy host to port 80 of Instance- 01. As the root user, in /etc, edit the rac- iptables.sh script. Underneath the Add your rules below line, insert your rule as follows:

6 iptables -t nat -A PREROUTING -p tcp! -s /8 --dport 80 -j DNAT --to <private IP of instance-01>:80 Ensure that in your Internal security group - which should be used by Instance has a rule added allowing traffic on port 80. Now source the rac- iptables.sh script:./rac-iptables.sh and visit hmp://<floaong IP address>/ with your web browser and you should see the default apache web server page ( It works! )